Looking Ahead to 2017 and Beyond

What an eventful year 2016 has been! We just about survived the fallout of the BREXIT referendum, we lost many famous faces such as David Bowie, Leonard Cohen, Gene Wilder and Muhammad Ali to name a few. Donald Trump was elected the 45th President of the United States and before all that, on the 14th April the European Union finally ratified the new General Data Protection Regulation (#GDPR).

Incredibly it's still only November!

Never before has a pending new year been looked forward to with such measures of pessimism and optimism in equal quantities. I am quite the optimist and believe that everything is going to work out just fine. That said, I am under no illusion that it is going to be straight forward, quite the opposite. I believe it will take an astronomical effort by families, groups, individuals, businesses's and the World as a whole to face the challenges that 2017 will undoubtedly bring.

Planning and preparation will be key, as ever, but so far as Data Security is concerned the pressure really is on for Security Consultants, CISO's, Integrators and Software Vendors alike to look into the future and adapt accordingly for the threats that lie ahead. A task made particularly difficult by changes in the current political climate and the scale of impact that these changes might have on our future.

Here I am going to look at 5 key topics that I believe should be on your radar for 2017:

1: BREXIT and GDPR

Whatever side of the BREXIT debate you find yourself on, one thing is for certain that GDPR will affect us all. In or Out? It doesn't matter. Any organisation handling personal identifiable information for EU Citizens, anywhere in the world, will be obliged to comply before the deadline in May 2018.

Trade with Europe will be as essential to Britain and the rest of the World tomorrow as much as it is today. One sure way to continue this trade will be making sure that your business, if required, complies with the new General Data Protection Regulation. This is a journey I have been taking many organisations on in helping them understand the impact it is likely to have on their business as well as how to address the key issues.

2: User & Entity Behaviour Analytics & Incident Response

It is no great secret that there has been a largely pessimistic shift in the mindset of experts in data security from not "if" but to "when" your organisation will be breached. This is hardly surprising given that most security solutions to date have taken a largely reactive response to dealing with security incidents.

These solutions have traditionally concentrated on protecting perimeters and end points which pretty much no longer exist in today's increasingly global workforce. SIEM is proven to overwhelm the security team with high volumes of alerts and even if an incident is reported a lack of a robust response plan can leave your business vulnerable.

According to Gartner, User Entity & Behaviour Analytics is emerging as one of the most promising solution areas to combat cyber threats and fraud by detecting malicious activity that otherwise goes unnoticed. UEBA consolidates and prioritises alerts from multiple different security sources and uses signature-less artificial intelligence and machine learning to alert against potential threats to your business.

Combining the artificial intelligence gathered from a signature-less based UEBA solution with a proven Incident Response platform enables your organisation to address incidents in real time, allowing you to stay one step ahead at all times.

3: PCI Compliance

Businesses in the UK will continue to face increasing risk from payment data theft. There were more than 2.46 million cyber incidents in the UK alone in 2015. In the first half of 2016 we saw more than 1.5 million incidents reported, representing a 25 per cent increase on the same period in 2015.

These incidents are predicted to rise by a further 30 per cent in the first half of 2017 seeing PCI pushed to the top of the agenda for many businesses. This is largely down to the expiration of PCI DSS 3.1 on 31st October 2016 but even more so because of the GDPR 2018 deadline that is just around the corner, potentially leaving organisations exposed to substantial penalties.

4: Data Classification & Data Governance

Getting your house in order is one of the key tasks for 2017. Nobody wants to be the first organisation to face the embarrassment of falling foul of GDPR compliance.

Data Classification and Data Governance will ensure that you have identified your most sensitive assets, know exactly where they are stored and find our exactly who has access to them. This will go a long way in ensuring compliance with some of the key fundamentals of GDPR such as "the right to be forgotten", "Geo-locations of EU citizens data" and ensuring "access to sensitive information on a need to know basis".

Identifying your most sensitive assets and ensuring sufficient protection is placed around them will form a huge part of your GDPR security strategy. I would suggest that this is first on your GDPR to-do list!

5: Security Awareness and Education

What can I say on this subject that I haven't said already? Employee's are the most important weapon in your arsenal in the war on Cyber Crime and play a critical role in defending against phishing, malware and ransomware attacks that lead to your data being compromised.

Having your most important weapon engaged and tuned into the threats that target your business on a daily basis is critical to the success of your Data Security strategy. Defining a security education programme and running regular workshops to raise awareness will give your armour that essential boost it needs going into the new year.

The future is a wonderfully unpredictable place where nobody can truly say what is going to happen. I do believe however it is a place where those who are better prepared will fair better than those who are not. It is no longer acceptable for us to sail along blissfully unaware of what lies around the corner.

2017 is going to bring us some huge challenges, some beyond our control but some that we can certainly tackle. If we work hard on trying to understand and address the threats of the future, using the lessons we have learnt from the past, I think we might just be OK!

Best Regards,

Danny Maher - @CTODanny